{"record":{"id":"4f0213bd9f7773fa","repo":"projectdiscovery/nuclei","slug":"error-sending-to-a-kdc-s","errorCode":null,"errorMessage":"error sending to a KDC: %s","messagePattern":"error sending to a KDC: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/kerberos/sendtokdc.go","lineNumber":101,"sourceCode":"\t\t}\n\t\ttcpConn, err := dialers.Fastdialer.Dial(dialCtx, \"tcp\", net.JoinHostPort(host, port))\n\t\tif err != nil {\n\t\t\terrs = append(errs, fmt.Sprintf(\"error establishing connection to %s: %v\", kdcs[i], err))\n\t\t\tcontinue\n\t\t}\n\t\tdefer func() {\n\t\t\t_ = tcpConn.Close()\n\t\t}()\n\t\t_ = tcpConn.SetDeadline(time.Now().Add(time.Duration(kclient.config.timeout) * time.Second)) //read and write deadline\n\t\trb, err := sendTCP(tcpConn.(*net.TCPConn), []byte(msg))\n\t\tif err != nil {\n\t\t\terrs = append(errs, fmt.Sprintf(\"error sending to %s: %v\", kdcs[i], err))\n\t\t\tcontinue\n\t\t}\n\t\treturn rb, nil\n\t}\n\tif len(errs) > 0 {\n\t\treturn nil, fmt.Errorf(\"error sending to a KDC: %s\", strings.Join(errs, \"; \"))\n\t}\n\treturn nil, nil\n}\n\n// sendToKDCUdp sends a message to the KDC via UDP.\nfunc sendToKDCUdp(kclient *Client, msg string) ([]byte, error) {\n\t_, kdcs, err := kclient.Krb5Config.GetKDCs(kclient.Realm, true)\n\tkclient.nj.HandleError(err, \"error getting KDCs\")\n\tkclient.nj.Require(len(kdcs) > 0, \"no KDCs found\")\n\n\texecutionId := kclient.nj.ExecutionId()\n\tdialers := protocolstate.GetDialersWithId(executionId)\n\tif dialers == nil {\n\t\treturn nil, fmt.Errorf(\"dialers not initialized for %s\", executionId)\n\t}\n\tdialCtx := kclient.nj.Context()\n\tvar errs []string\n\tfor i := 1; i <= len(kdcs); i++ {","sourceCodeStart":83,"sourceCodeEnd":119,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/kerberos/sendtokdc.go#L83-L119","documentation":"sendToKDCTcp resolves every KDC for the realm (from krb5 config or DNS SRV), tries each over TCP, and collects a failure string per attempt. When none succeed it returns the joined list. This error is the aggregate TCP-side verdict; SendToKDC then attempts UDP as a fallback.","triggerScenarios":"Outbound TCP/88 blocked to every domain controller; a misspelled realm yielding unreachable SRV targets; every KDC behind a firewall that silently drops SYN packets so each dial times out; the 5s default deadline expiring on each attempt.","commonSituations":"Scanning Active Directory segments from networks without KDC reachability; stale DNS SRV records pointing at decommissioned DCs; egress-filtered container/CI environments; VPN split-tunnel setups missing the DC routes.","solutions":["Confirm the realm string matches the AD domain and that _kerberos._tcp.<REALM> SRV records resolve to live DCs","Allow outbound TCP/88 to the domain controllers","Let the automatic UDP fallback run; if UDP also fails, check firewalling of UDP/88","Raise the client timeout above the 5s default for remote or slow KDCs"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  const resp = kerberos.SendToKDC(client, msg);\n} catch (e) {\n  // all TCP KDC attempts failed; the library already tries UDP as fallback - check realm, DNS SRV records, and TCP/88 egress\n}","preventionTips":["Verify the realm and _kerberos._tcp.<REALM> SRV resolution before scanning","Ensure egress to TCP/88 on domain controllers is allowed","Raise the timeout above the 5s default for remote domains"],"tags":["kerberos","network","tcp","kdc"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}